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to Section 702 of the Foreign Intelligence Surveillance Act, Submitted by the Attorney 
General and the Director of National Intelligence 
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Reporting Period: June 1, 2009 - November 30, 2009 

(U) SECTION 1: INTRODUCTION 

(U) The FISA Amendments Act of 2008, Pub. L. No. 1 10-261, 122 Stat. 2438, now 
codified at 50 U.S.C. § 1881a (hereinafter "FAA"), requires the Attorney General and the Director 
of National Intelligence to assess compliance with certain procedures and guidelines issued 
pursuant to Section 702 of the Foreign Intelligence Surveillance Act of 1978, 50 U.S.C. § 1801 
seq. (hereinafter "FISA"), as amended by the FAA, and to submit such assessments to the Foreign 
Intelligence Surveillance Court (FISC) and relevant congressional committees at least once every 
six months. As required by the Act, a team of oversight personnel from the Department of Justice 
(DOJ) and the Office of the Director of National Intelligence (ODNI) have conducted compliance 
reviews to assess whether the authorities under Section 702 of FISA have been implemented in 
accordance with applicable procedures and guidelines, described below. This report sets forth DOJ 
and ODNI's third joint compliance assessment under Section 702 of FISA, as amended by the FAA, 
covering the period June 1 , 2009, through November 30, 2009 (the "reporting period"). 1 

(U) Section 702(1) of FISA, as amended by the FAA, provides: 

Not less frequently than once every 6 months, the Attorney General and Director of 
National Intelligence shall assess compliance with the targeting and minimization 
procedures adopted in accordance with subsections (d) and (e) and the guidelines 
adopted in accordance with subjection (f) and shall submit each assessment to — 

(A) the Foreign Intelligence Surveillance Court; and 

(B) consistent with the Rules of the House of Representatives, the 
Standing Rules of the Senate, and Senate Resolution 400 of the 94th 
Congress or any successor Senate resolution — (i) the congressional 
intelligence committees; and (ii) the Committees on the Judiciary of the 
House of Representative and the Senate. 

(U) The targeting procedures referred to in subsection (d) are procedures that the Attorney 
General must adopt, in consultation with the Director of National Intelligence, "that are reasonably 
designed to (A) ensure that any acquisition authorized under subsection (a) is limited to targeting 
persons reasonably believed to be located outside the United States; and (B) prevent the intentional 



1 (U) This report accompanies the Semiannual Report of the U.S. Department of Justice Concerning Acquisitions under 
Section 702 of the FISA, which is submitted pursuant to Section 707 of FISA, as amended by the FAA, and covers the 
same reporting period. 
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acquisition of any communication as to which the sender and all intended recipients are known at 
the time of the acquisition to be located in the United States." Section 702(d) (2) requires that these 
procedures be reviewed by the FISC. 

(U) The minimization procedures referred to in subsection (e) must also be adopted by the 
Attorney General in consultation with the Director of National Intelligence. They must meet the 
definition of "minimization procedures" under Section 101(4) or 301(4), as appropriate, of FISA. 2 
They must also be reviewed and approved by the FISC. 

(U) The guidelines referred to in subsection (f) similarly must be adopted by the Attorney 
General, in consultation with the Director of National Intelligence. The purpose of these guidelines 
is to ensure compliance with the limitations set forth in Section 702(b), which are as follows: 

An acquisition authorized under subsection (a) — 

(1 ) may not intentionally target any person known at the time of acquisition to be 
located in the United States; 

(2) may not intentionally target a person reasonably believed to be located outside the 
United States if the purpose of such acquisition is to target a particular, known 
person reasonably believed to be in the United States; 

(3) may not intentionally target a United States person reasonably believed to be 
located outside the United States; 

(4) may not intentionally acquire any communication as to which the sender and all 
intended recipients are known at the time of the acquisition to be located in the 
United States; and 

(5) shall be conducted in a manner consistent with the fourth amendment to the 
Constitution of the United States. 



2 (U) Section 101(h) provides: 

"Minimization procedures", with respect to electronie surveillance, means— 

(1) specific procedures, which shall be adopted by the Attorney General, that are reasonably designed in light 
of the purpose and technique of the particular surveillance, to minimize the acquisition and retention, and 
prohibit the dissemination, of nonpublicly available information concerning unconsenting United States 
persons consistent with the need of the United States to obtain, produce, and disseminate foreign intelligence 
information; 

(2) procedures that require that nonpublicly available information, which is not foreign intelligence 
information, as defined in subsection (e)(1), shall not be disseminated in a manner that identifies any United 
States person, without such person's consent, unless such person's identity is necessary to understand foreign 
intelligence information or assess its importance; 

(3) notwithstanding paragraphs (1) and (2), procedures thai allow for the retention and dissemination of 
information that is evidence of a crime which has been, is being, or is about to be committed and that is to be 
retained or disseminated for law enforcement purposes; and 

(4) notwithstanding paragraphs (1), (2), and (3), with respect to any electronic surveillance approved pursuant 
to section 1 02(a) [50 USCS § 1 802(a)], procedures that require that no contents of any communication to 
which a United States person is a party shall be disclosed, disseminated, or used for any purpose or retained for 
longer than 72 hours unless a court order under section 105 [50 USCS § 1805] is obtained or unless the 
Attorney General determines that the information indicates a threat of death or serious bodily harm to any 
person. 
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These guidelines, the Attorney General's Guidelines for the Acquisition of Foreign Intelligence 
Information Pursuant to the Foreign Intelligence Surveillance Act of 1978, as amended (the 
Attorney General's Acquisition Guidelines), were adopted hy the Attorney General in consultation 
with the Director of National Intelligence on August 5, 2008. 





ODNI 0073 



TOP SEC RET/ / COMINT//N OFORN 



(U) As with the prior joint assessments, this joint assessment first provides a description of 
the process by which the authorities granted under Section 702 are implemented. It then describes 
the conduct of the compliance assessments themselves - explaining the methodology used by the 
joint DOJ and ODNI team to review the measures being used to implement the authorities - and 
assesses compliance with the procedures and guidelines. These descriptions are necessary to 
provide context for the findings. 



(U//FOUO) This assessment finds that during the reporting period, the agencies have 
continued to implement the procedures and follow the guidelines in a manner that reflects a focused 
and concerted effort by agency personnel to comply with the requirements of Section 702. The 
compliance incidents for the reporting period are described in detail in the Semiannual Report of the 
Attorney General Concerning Acquisitions under Section 702 of FISA, March 2010, submitted as 
required by Section 707(b)(1) of FISA, as amended by the FAA (the "Section 707 Report")- As 
with the prior joint assessments, those compliance incidents are analyzed here to determine whether 
there are patterns or trends that might indicate underlying causes that could be addressed through 
additional measures, and to assess whether the agency involved has implemented measures to 
prevent recurrences. First, as in the prior joint assessment reports, it should be noted that the joint 
oversight team has not found indications in these compliance incidents of any intentional or willful 
attempts to violate or cir cumvent the requirements of the Act. Second, the number of comp liance 
incidents remains s mall, \ 

| Third, certain types of compliance incidents continue to occur, indicating the 
need for continued focus on measures to address underlying causes, including the potential need for 
additional measures. The oversight team is continuing to evaluate the manner in which it conducts 
oversight to find areas to make oversight more efficient and effective. 



(U) SECTION 2: IMPLEMENTATION OF SECTION 702 AUTHORITIES - OVERVIEW 



(S) I. Overview - NSA 



(TS//ST//W ) NSA seek s to acquire foreign intelligence information concerning specific 
targets | | from or with the assistance of electronic communication service 

providers, as defined in section 701(b)(4) of FISA, as amended by the FA A. 4 As required by 



i 



4 (U) Specifically, Section 701(b)(4) provides: 

The term 'electronic communication service provider' means - (A) a telecommunications carrier, as that term 
is defined in section 3 of the Communications Act of 1934 (47 U.S.C, 153); (B) a provider of electronic 
communication service, as thai term is defined in section 2510 oftillc 18, United States Code; (C) a provider of 
a remote computing service, as that term is defined in section 271 1 of title 18, Umled States Code; (D) any 
other communication service provider who has access to wire or electronic communications either as such 
communications are transmitted or as such communications are stored; or (E) an officer, employee, or agenl of 
an entity described in subparagraph (A), (B), (C), or (D). 
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Section 702. those targets must be non-United States persons 5 reasonably believed to be locat ed 
outside the United States. I 



it is subject to 



£PS//WNF) Once information is collected 
FISC-approved minimization procedures. NSA's minimization procedures set forth specific 
measures NSA must take when it acquires , retains, and/or disseminates non-publicly available 
information about United States persons. | 



5 (U) Section 101 (i) of F1SA defines "United States person" as follows: 

a citizen of the United States, an alien lawfully admitted for permanent residence (as defined in 
sectionl01(a)(20) of the Immigration and Nationality Act [8 U.S.C. § 1 101 (a){20)]), an unincorporated 
association a substantial number of members of which are citizens of the United States or aliens lawfully 
admitted for permanent residence, or a corporation which is incorporated in the United States, but does not 
include a corporation or an association which is a foreign power, as defined in subsection (a)(1), (2), or (3). 
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(S) NSA's targeting procedures address, among other subjects, the manner in which NSA 
will determine that a person targeted under Secti on 702 is a non-United States person reasona bly 
believed to be located outside the United States, \ 
and the documentation required. 

(U) A. Location. 

(S) The procedures provide that NSA's targeting determina tions should be made in ligh t of 
the totality of the circumstances based on the information available j 





NS A has developed a list of factors to facilitate training and tasking for its analysts to use when iden tifying 
and meeting documentation requirements under the "totality of the circumstances" requirement. 
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(XI) B. United States Person Status. 
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(S) The source records cited | | sheets are contained in a variety of NSA data 

repositories. These records ar e retrieved by NSA. when requested by the DO.T/ODNI oversig ht 
team, to verify determinations \ 





(U) G. Oversight and Compliance. 

(S) The procedures require that NSA's Signals Intelligence Directorate (SID), together with 
NSA's Office of General Counsel (OCC), provide training on the procedures. They further provide 
that SID Oversight and Compliance will conduct oversight activities and make any necessary 
reports, including those relating to incidents of non-compliance, to the NSA Inspector General and 
NSA's OGC, and will ensure that necessary corrective actions are taken to address any identified 
deficiencies. SID Oversight and Compliance conducts spot checks of targeting decisions and 
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disseminations to ensure compliance with procedures. In December 2009, NSA deployed updated 
and improved platform-based training, which includes a competency test, for Section 702 and 
Protect America Act (PAA) data, some of which is still retained by NSA. Information on the NSA 
internal web site is updated by SID Oversight and Compliance as appropriate regarding 
implementation of Section 702 authorities. 

(S) NSA has instituted internal training programs, access control procedures, standard 
operating procedures, compliance incident reporting measures, and similar processes to implement 
the requirements of the targeting procedures. Only analysts who have received certain types of 
training and authorizations are p rovided access to the Section 702 program data. They must review 
an NSA OGC training program: I 

( and must take an examination. 
The databases NSA analysts use are subject to audit/review by SID Oversight and Compliance, as 
well as by the NSA's Office of Inspector General (OIG). They may consult standard operating 
procedures for guidance, as well as supervisors, SID Oversight and Compliance personnel, NSA 
OGC attorneys, and the NSA Office of Compliance. 

(S) In addition, the procedures provide that DOJ and ODNI will conduct oversight of 
NSA's exercise of authority under Section 702 of the Act, including periodic reviews by DOJ and 
ODNI personnel to evaluate the implementation of the procedures at least once every sixty days 
(further discussed below). 

(5) The procedures call for NSA to report to DOJ and ODNI any incidents of non- 
compliance with the procedures by NSA personnel that result in the intentional targeting of a person 
reasonably believed to be located in the United States or the intentional acquisition of any 
communication in which the sender and all intended recipients are known at the time of acquisition 
to be located within the United States, with a requirement to purge from NS A's records any 
resulting collection. NSA must also report any incidents of non-compliance, I J 

| Additionally, if NSA learns, after targeting a person reasonably believed to be outside the 
United States, that the person is inside the United States, or if NSA leams that a person who NSA 
reasonably believed was a non-United States person is in fact a United States person, NSA must 
terminate the acquisition, and treat any acquired communications in accordance with its 
minimization procedures. In each of the above situations, the Section 702 procedures during this 
reporting period required NSA to report the incident to DOJ and ODNI within the time specified in 
the targeting procedures of learning of the incident. 

(6) NSA has established an incident tracking and reporting standard operating procedure to 
implement the foregoing. NSA has indicated that such incidents are tracked using a pre-established 
tracking template that includes fields for the information to be reported to DOJ and ODNI. In 
addition to the Oversight and Compliance office, the NSA OGC and OIG are included in the 
process. 

(U/FOUO) In July 2009, NSA established the Office of the Director of Compliance, which 
is responsible for continuous modernization and enforcement of all mission compliance strategies 
and activities to ensure their relevance and effectiveness. This office complements and reinforces 
the intelligence oversight program of the NSA Inspector General and oversight responsibilities of 
the NSA General Counsel by creating a Comprehensive Mission Compliance Program (CMCP) to 
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ensure that progress is made across the board at NSA. This compliance program includes, among 
other things, special compliance activities focused on select FISA authorities as well as awareness_ 
and training which ensures a robust compliance training and education program for employees. 



V* 



(S) II. Overview- FBI 

(S) FBI is authorized 
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(S) A. FBI Targeting Procedures. 
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(U) B. Documentation. 




(U) C. Oversight and Compliance. 
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(U) IV. Overview -Minimization . 



(S) As referenced above, once | | has been tasked for collection, non-publicly 
available information collected as a result of these taskings that concerns United States persons 
must be minimized. The FISC-approved minimization procedures require such minimization in the 
acquisition, retention, and dissemination of foreign intelligence information. As a general matter, 
minimization procedures under Section 702 are similar in most respects to minimization under other 
FISA orders. 




The minimization procedures, however, do reflect 
differences from minimization under FISA orders where Section 702 imposed additional obligations 
or restrictions. For example, the Section 702 minimization procedures require, with limited 
exceptions, the purge of any communications acquired through the targeting of a person who at the 
time of targeting was reasonably believed to be a non-United States person located outside the 
United States, but is in fact located inside the United States at the time the communication is 
acquired, or was in fact a United States person at the time of targeting. 



(U) SECTION 3: CONDUCT OF COMPLIANCE ASSESSMENT ACTIVITIES 

(U) I. Work of the Compliance Assessment Team . 

(U) A. Compliance Assessment Team Members. 

(U) Compliance assessment activities have been jointly conducted by DOJ and ODNI. 
Specifically, a joint team has been assembled, consisting of members from the DOJ's National 
Security Division (NSD), ODNI's Civil Liberties and Privacy Office (CLPO), ODNI's Office of 
General Counsel (OGC), ODNI's Office of Inspector General (OIG), and ODNI's Office of Deputy 
DNI for Collection. The team members play complementary roles in the review process. While all 
team members s eek to ensure compl iance with requirements and review available documentation, 
DOJ focuses on | | reviews and completing reporting requirements, and ODNI 

seeks to identify programmatic and interagency issues. 

(U) B. Compliance Assessment Visits. 



(S//NF) The team organized its reviews based on the 60-day review cycle required by the 
procedures under each certification. For the reporting period, the on-site visits were as follows: 



Date of Visit 


^^^B B ! Agency 


Taskings Reviewed 


August 6, 2009 
August 13, 2009 




June 2009 


June 1 - July 31,2009 


September 3, 2009 


July 2009 
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September 22, 2009 




June 1 - July 31,2009 


October 6, 2009 




August 2009 


October 13,2009 




August 1 - September 30, 2009 


October 26, 2009 




August 1 - September 30, 2009 


November 10, 2009 




September 2009 


December 9, 2009 




October 2009 


December 10, 2009 




October 1 - November 30, 2009 


December 15,2009 




October 1 - November 30, 2009 


January 12, 2010 




November 2009 



(S//NF) ODN1 and DOJ have assessed the oversight process used since Section 702 was 
implemented in 2008, and has identified certain positive results. The oversight team has found that 
a large percentage of compliance incidents reported in the Section 707 Reports have been self- 
identified by the agencies. To optimize current resources in the oversight process, ODNI and DOJ 
are consulting on the best ways to maximize oversight resources. 



(S/NFt To begin this change, the oversight team has instituted meeting 




ODNI and DOJ assess that these discussions will enhance communications among the parties 
concerned with Section 702 collection, and will help reduce the number of reportable compliance 
incidents. 



(S//SI//NF) Review of statistical information regarding the number | | on coverage 
is helpful for oversight planning purposes, trend and pattern analysis, and evaluation of underlying 
causes. 
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(U) II. The Compliance Review Process . 



(S) A. Review Process - NSA. 



(S) Prior to a visit date, NSA electronically sends | I tasked 

dunng the review period to DOJ and ODNI. DOJ attorneys conduct a review ot | 

If 2 ) and prepare a detailed report of their findings, which they share with the OD NI members of 
the review team. During their reviews, DOJ attorneys seek to determine whether the | 
meet the documentation standards required by NSA's targeting procedures and provide sufficient 
infor mation for the r eviewers to ascertain the basis for NSA's foreignness determinations. For 
those | | that, on their face, meet standards and provide sufficient information, no 

fvirthersvrpporting documentation is requested for the onsite review. DOJ attorneys then identify 
the | | that, without further review of the cited documen tation, did not provide sufficient 

informat ion, and s et forth their questions for each of those | |. The review team then focuses 
on those | | during the subsequent review. 



(S) This initial review serves an important functi on for the review t eam. By reviewing the 
documentation "off site," the DOJ attorneys can analyze | | with care, and make 

initial review assessments based on the tvpe of information set forth on the selector sheets. For 



(S) As further discussed in the Section 707 Report, in August 2009, ODNI and DOJ learned that they had not been 



provided with 
process to ensure that the 




NSA is continuing to evaluate its retrieval 
are also provided for review. 
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with analysts to ask questions, identify issues, clarify ambiguous entries, and provide guidance on 
areas of potential improvement. Interaction continues following the onsite reviews in the form of e- 
mail and telephonic exchanges to answer questions and clarify issues. 

(S) Following the completion of a 60-day review cycle, DOJ prepares a report documenting 
the results of the review for that period. This report is provided to congressional committees as an 
attachment to the Section 707 Report. It documents the relevant ti me perio d of the review, the date 
of the onsite visit, the agencies reviewed, the number and types of | |. and a detailed summary 
of the findings for that review period. These repor ts contain specific details - without providing 
|H - that explain, | |, the issues addressed by the oversight team as 

part of its review during that period, and the outcome of each issue. 

(S) B. Review Process - FBI. 



For FBI, the review team schedules a visit in advance with FBI, so that FBI can prepare 
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(U) D. Review Process - Minimization. 

(S) During the onsite visits to NSA, the team reviews NSA's | (of Section 702- 

acquired data to verify compliance with minimization procedures. The team reviews all serialized 
reports based on Section 702-acquired data that NSA identifies as containing United States person 
information. The results of these reviews have been documented and included as attachments to the 
Section 707 Report. During this review penod, the team also began to take a random sample of 
reports not identified by NSA to ensure that NSA was accurately identifying all reports containing 
United States person information. 
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(U) E. Review Process - Compliance Incident Reports. 

(S) The targeting procedures during the reporting period required that incidents of non- 
compliance be reported to DOJ and ODNI within five business or seven calendar days (depending 
on the applicable set of procedures) of the reporting agency learning of the incident. These reports 
are reviewed by the team, with follow-up questions asked for clarification and action. These 
incidents are often discussed during the regularly scheduled reviews. Where necessary, the team 
also has conducted onsite investigations of particular incidents. Compliance incidents have been 
reported to th e FISC in individual com pliance notices to the Court, filings related to the FISC's 
review of the | |, and/or in the Section 707 report. 

(S//NF) On August 25, 2009, the FISC ordered that DOJ provide reports to the FISC every 
90 days providing the FISC with timely and effective notification of compliance issues involving 
the Government's implementation of its authorities under Section 702, including matters not 
covered by notices pursuant to Rule 10(c) of the Rules of Procedures for the FISC. The first report 
was filed with the FISC on December 7, 2009. 23 



(U) SECTION 4: COMPLIANCE ASSESSMENT - FINDINGS 

(U//FOUO) This assessment finds that during the reporting period, the agencies have 
continued to implement the procedures and follow the guidelines in a manner that reflects a focused 
and concerted effort by agency personnel to comply with the requirements of Section 702. The 
personnel involved in implementing the authorities are appropriately focused on directing their 
efforts at non-United States persons reasonably believed to be located outside the United States. 
Processes have been put in place to implement these authorities and to impose internal controls for 
compliance and verification purposes. 

(S) There have been some compliance incidents during the reporting period representing a 
very small percentage of the overall activity. The DOJ and ODNI oversight team does not believe 



(S//NF) The first report covered the period August 25, 2009 through November 30, 3009, a period greater than 90 
days. The time for reporting was extended for the first report in order to correspond with the reporting period for this 
Semiannual Assessment Report and the corresponding Seetion 707 Report. 
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these incidents represent an intentional attempt to circumvent or violate the procedures required by 
the Act. 

(S) The compliance incidents for the reporting period are described in detail in the Section 
707 Report, and, as with the prior joint assessments, are analyzed here to determine whether there 
are patterns or trends that might indicate underlying causes that could be addressed through 
additional measures, and to assess whether the agency involved has implemented measures to 
prevent recurrences. The oversight team is continuing to review the efficacy of those measures on a 
continuing basis. 

(U) I. Compliance Incidents - General. 

(S) As previously stated, the compliance incidents identified in this reporting period have 
been separately reported in detail in the Section 707 Report. The Section 707 Report covers those 
compliance incidents in the Attorney General's Third Semiannual Report Concerning Acquisitions 
under Section 702 ofFISA. 

(U) The compliance incidents are reviewed here m general terms to assess broader 
implications - the details are not repeated unless directly relevant to a point being made. 

(U) A. Statistical Data Relating To Compliance Incidents. 




TOP SECRET//COMINT//NOFORN 



23 



TOP SECRET//COMINT//NOFORN 




(S) In seeking to assess the value of such statistical data, the oversight team is evaluating 
the means for collecting and analyzing such data. For example, it may be useful to examine the 
statistical data through the lens of each agency. Moreover, it may prove useful to analyze the types 
of incidents that comprise the "numerator" and the type of activity that those incidents are being 
compared against - the denominator - in order to derive more targeted metrics and insights. 
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(S) Again, the joint oversight team does not wish to over-emphasize what can be inferred 
from statistics such as these. In particular, as stated in the prior report, the incidents themselves 
must be examined, since each - individually or collectively - might he indicative of patterns, trends, 
or underlying causes with broader implications. 
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27 (U) Incident citations refer to the citations used in the Section 707 Report. 
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29 (U//FOUO) Section 702(b)'s limitation on targeting United States persons does not contain an exception for consent. 
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(S) I. Documentation Incidents. 

(S) As described in the Section 707 Report, documentation issues are summarized in 
compliance review memoranda prepared by DOJ following each on-site review. Thes e memorand a 
detail th e number and types of documents reviewed, the specific issues identified on a \ 

| basis, and how each issue was resolved during or following the on-site review. Each 
review memorandum is attached to the Section 707 Report. 

fS4 The oversight team has noted continued improvement in documentation practices 





The addition of the targeting rationale | 
explanatory information to further understand why a particular | 

While interactions between oversight and agency personnel have helped improve 
expectations and understandings regarding documentation practices, as with the last joint 
assessment, the review memoran da atta c hed to the S ec tion 70 7 Report co nt inue to note specifi c 
issues on a case.-bv-case basis. 




Discussions between the oversight team and agency 
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(U) SECTION 5: CONCLUSIONS. 

(U//FOUQ) During the reporting period, the agencies have continued to implement the 
procedures and follow the guidelines in a manner that reflects a focused and concerted effort by 
agency personnel to comply with the requirements of Section 702. The joint oversight team has not 
found indications of any intentional or willful attempts to violate or circumvent the requirements of 
the Act in the compliance incidents assessed above. The number of compliance incidents remains 
small, particularly when compared with the total amount of activity. Certain types of compliance 
incidents continue to occur, indicating the need for continued focus on measures to address 
underlying causes. The oversight team will continue to review the efficacy of measures to address 
the causes of compliance incidents during the next reporting period. In addition, the oversight team 
is continuing to evaluate the manner in which it conducts oversight to find areas to make oversight 
more efficient and effective. 
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